Infostealer Malware and the Browser Sessions It Sells
Infostealer malware does one job well: it copies everything the browser holds. Saved passwords, session cookies, autofill data , often within hours, to people who specialise in using them. The infection usually happens on a personal machine, which is why the incident arrives at your company without ever touching a device you manage.
How people get infected
The delivery methods target impatience rather than ignorance. Cracked software and game cheats remain reliable, as does a search advertisement for a popular utility that leads to a convincing but malicious download page. A newer pattern presents a fake verification prompt asking the user to paste a command into a dialog to prove they are human, which runs the payload with their permission. Household machines matter here as much as personal laptops, since one work login saved on a shared family computer is enough. The NCSC’s guidance on mitigating malware attacks makes the same point about layered defence: user judgement is one layer and it will sometimes fail.
Why this reaches corporate systems
Staff sign into work applications on personal devices more often than policy admits, and browsers helpfully synchronise saved passwords and sessions between machines. A stolen cookie for your customer portal or your Microsoft tenant is an authenticated session that skips both the password and the multi-factor prompt. Because the theft happens on a machine you do not monitor, your first indication is a login from somewhere unexpected, and that is only if you are alerting on it.
“The stolen credential lists we see in incident work are dominated by home machines belonging to people who never break a single company rule at work. Blocking unmanaged devices from reaching your data does more than any awareness campaign, because it stops the stolen session being useful rather than trying to prevent every infection.”
See also: Understanding the End-to-End Mobile App Development Lifecycle
William Fieldhouse, Director, Aardwolf Security Ltd
Controls that reduce the impact
Require managed, compliant devices for access to email, files and administrative interfaces, which removes the value of a session stolen from a home computer. Use phishing-resistant authentication for privileged accounts, and shorten session lifetimes for anything sensitive so a replayed cookie expires quickly. Turn off browser password saving through policy on managed devices and give people a password manager instead. Where your platform supports token binding or continuous access evaluation, enable it, since both make a stolen session harder to use elsewhere.
Detecting the sessions in use
Watch for the signs of a replayed session rather than a failed login. Sign-ins from hosting provider address ranges, two locations in an implausible time window, a new device appearing on an established account and unusual mailbox rules are the useful signals. Subscribe to a credential exposure service so you learn when your domain appears in a stolen data set. Microsoft 365 security testing checks whether your Conditional Access policies genuinely block an unmanaged device, and application security testing covers the same question for your own customer-facing systems, which are targeted with the same stolen sessions.
Frequently asked questions about infostealers
These questions come up whenever stolen credentials appear in a monitoring feed.
Does changing the password fix it?
Only partly. A password change deals with the stolen password and leaves stolen session cookies working until they expire or are revoked, so revoke sessions as well and check for new authentication methods on the account.
Should personal devices be banned outright?
Banning is rarely enforceable. Requiring device compliance for access to sensitive data achieves the same outcome and leaves low risk uses, such as webmail on a personal phone, subject to whatever controls you decide are proportionate.
